Team,
I'd like to discuss this issue, because after reading the manual, several other users posts and the responses from the forum members (specially 3CXsupport, itfarmer and others with high rank), I think the process for making 3CX work seamlessly with both internal and external phones (either hard or soft) in a NATed environment should be more clearly documented and made sticky. This would help to avoid multiple posts on the same topic, and be a step-by-step guide for everyone in the same situation to follow, thus improving customer satisfaction and the product's spread.
My scenario is the following: I have a Windows XP PC, and I've been running 3CX since versions 2.x, and lately the 1699, 1928 and 1929 builds of the 3.x train. It does not have any SW FW enabled, and is located in a subnet with private addressing (192.168.x.x) behind a Symantec firewall connected to the Internet. The public IP address is dynamic, so a Dynamic DNS service is used to make the external devices find home. I have both fixed internal HW phones and external mobile softphone users (that may be at any time directly connected to Inet, or through a HW NAT firewall. I've tried several softphones, but the most flexible seem to be x-lite and idefisk, which automatically find out if NAT /STUN is required or not.
To answer Travis' question, I have COSUN HW phones, which support lots of IP phones modes (including nortel and other proprietary IP modes as well as SIP), STUN, all popular codecs, etc.
As suggested in the manual and the forums, I've forwarded to the 3CX PBX in the FW ports 5060-5063 both UDP and TCP (although the FW log shows only 5060 is used) and 9000-9007 for external phones RTP (same as on the 3CX config page). I also previously had UDP 3478, but learned that only outgoing STUN packets need to be allowed (on by default for external IP config).
One point I want to discuss is the requirement in some posts to open the external FW to forward HUGE port ranges (7000-7500, and 10000 to 20000) to allow internal-to-external or external-to-external calls. This is dissapointing from a security standpoint, and also contradicts the manual's requirement to open the 900x ports for these calls types.
From my experience analyzing the FW's and 3CX's logs, I found the following:
- The server correctly communicates with the STUN server, and shows this in the log, usually getting a port in the 50000+ range:
StunClient:
rocess STUN resolved external IP=200.126.nn.nn:52800 by server 80.239.235.209
- The phones, both internal and external, correctly register, place and hang calls over port 5060:
23:06:09.781 StratLink:
nHangUp Call(C:1): Ext.100 hung up call; reason: BYE
23:06:05.078 CallLegImpl:
nConnected Call(C:1): Created audio channel for Ext.100 (192.168.128.2:10020) with Media Server (192.168.128.5:7058)
23:06:05.062 StratInOut:
nConnected Call(C:1): Setup completed for call from Ext.101 to Ext.100
23:06:05.062 CallLegImpl:
nConnected Call(C:1): Created audio channel for Ext.101 (192.168.128.3:8000) with Media Server (192.168.128.5:7060)
23:05:56.890 CallConf:
nProvisional Call(C:1): got response from 100
23:05:56.625 CallConf:
nIncoming Call(C:1): Incoming call from Ext.101 to sip:
[email protected]
- I have all phones accounts setup to bind to Media Server, so that all calls flow through it, to avoid the needs to setup specific RTP ports on each internal phone, and configure individual phone RTP forwarding rules in the FW, which would become a security and administrative nightmare. Thus, all external phones have a tick in "Extension is external", but not the internal ones. All of them also have the "Supports Re-Invite" and "Supports 'Replaces' header" ticks in.
So, the thing is that when trying to place calls between external and internal phones, the 3CX Media Server correctly handles the internal "leg" between itself and the internal phone, but then tells the remote phone to send its call flow over to a 50000+ port in the FW's public IP, instead of using the 900x ports specifically configured for this. I think this 50K+ port is obtained from a STUN process, but the audio from the remote phone gets blocked (audio flows seamlessly from internal to external, because the MS correctly sends the RTP flow to the RTP port reported by the external device).
For some reason, I can not erase the STUN server configuration in the config page (I can only change the server name), or otherwise tell the server to ignore STUN at all, so I'm unable to force the MS to use the specific 900x ports reserved and forwarded for that purpose. I don't really think STUN disable is a good idea, but it would be to make a smarter use of it (or, at least try to make use of 900x ports before).
A test was also made to open the mentioned 7000-7500 port range and make all phones Internal, which ctually worked (like if they all where on the same LAN) but again, this contradicts the very need for the 900x range definition, and creates a potential security or DoS hole too big for my taste.
I have extensive experience in Windows, Linux and Firewalls from many makes and sizes administration and support, but I just can't figure out how to make 3CX MS to use the 900x range.
Any help would be really appreciated, and if the logs are needed, I can send them privately by mail, to avoid exessive clogging of the forum. I'd also like to see if the Advanced terms "Supports Re-Invite" and "Supports 'Replaces' header" could be explained a little more, maybe providing scenarios in which to mark them or not, to expand the manual's sections.
Hope this helps the community (my 2 cents).
Thanks and regards,
Ricardo
. 
